Security
Our agents hold client-confidential information, and every firm we work with assesses us on it. Here are the standards we work to and how we handle your data.
ISO/IEC 27001:2022
Certified by A-LIGN, a UKAS-accredited certification body. Certificate ISMS-LE-092326 was issued on 23 September 2026 and is valid to 23 September 2029, subject to annual surveillance audits.
UK GDPR and EU GDPR
Registered under reference ZB917162. We work to a written data processing agreement, process client data only on documented instructions, and support retention limits and deletion on request.
Penetration testing
Our applications are tested by an independent specialist against environments that mirror production. Findings are tracked to closure through our management system.
Insurance
We carry professional indemnity and cyber liability insurance. Certificates are provided on request.
Residency and retention
Client data is hosted and processed in the EU by default, on Google Cloud in Belgium. UK hosting in London is available on request. Retention is set per firm, including deployments that keep nothing beyond the conversation.
Your content stays yours
Your data is never used to train our models, or anyone else's. This is written into our contracts with each model provider, and our providers keep no customer data.
Voice
Voice is held to the same standard as text: recordings are encrypted on capture, processed in isolated environments, and can be deleted automatically after processing.
Access
Your people sign in with your own identity provider, so your multi-factor and access rules apply. Access to client environments is role-based and reviewed on a schedule.
Full detail, policies and supplier information are available through the Trust Centre.